Malicious
ZIP Archive
MD5: 9dfc29fcbae3f85a932141966378f274
Size: 25.6 MB
application/zip
Ctrl + scroll to zoom · drag to pan
This sample is a 24.4 MB ZIP Archive classified as malicious by Malva.RE. Static analysis extracted 988 embedded or derived files. It matches 21 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.
- SHA256
- 30e6f65380198bd4d49227d780f19a01d297aa8ed7ae643167e490f5e7b8fca5
- MD5
- 9dfc29fcbae3f85a932141966378f274
- Verdict
- Malicious
- File type
- ZIP Archive · 24.4 MB
Cite this report: https://app.malva.re/sha256/30e6f65380198bd4d49227d780f19a01d297aa8ed7ae643167e490f5e7b8fca5
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
25.6 MB · 25,599,003 B
First seen
2026-11-01 00:15 · yesterday
Last seen
2026-11-01 00:15 · yesterday
Last analysis
2026-11-01 00:16 · yesterday
Hashes
MD5
9dfc29fcbae3f85a932141966378f274
Sha1
ba3b01c90d517eaa3b59c8ca730d94290ddefd4f
Sha256
30e6f65380198bd4d49227d780f19a01d297aa8ed7ae643167e490f5e7b8fca5
Sha384
efbeb65156d512861157923763c702a5e90b7b457b757801ec32f8e1181331b996acf29fab9bdbec220efdeed8d8272b
Sha512
d04186fb93bbd8f96761286e3f6a5d244ed01d86f8c2730522a408fb669712bd20f8fa2fbe628eb14db31eff5fca09c885814a3469fd9b15588a9b32e8269853
SSDeep
786432:qotJpzs4vIBOmJPj1j/FVs4vbRos4vzRJ:qo9nvsxRVnvbGnvzRJ
TLSH
5C47236CB8B5B84AF5D0537BC6C52CBAEB2CE541D7E93C9B8E2440467D8310E4F6AC61
2 malicious · 772 files
ZIP9dfc29fcbae3f85a932141966378f274CVE-2019-9674
DLLcnhi8308.dll
BINControl
BINlib
HTMpython37.dll
Structure
BINOverlay_84d60e2c.bin
BINResources
EXESetup.exe
DLLvcruntime140.dll
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
10 / 10
Path
arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
Shape
arc:zip>pe:dll>pe:rsrc>pe:dll>pe:rsrc>bin
malicious
6 nodes
Path
arc:zip>pe:dll>pe:rsrc>pe:dll>bin
Shape
arc:zip>pe:dll>pe:rsrc>pe:dll>bin
malicious
5 nodes